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**E-filed 1/23/12** 



IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF CALIFORNIA 
SAN FRANCISCO DIVISION 

EDWARD HASBROUCK, No. C 10-3793 RS 

Plaintiff ORDER RE CROSS-MOTIONS FOR 

v SUMMARY JUDGMENT 



U.S. CUSTOMS AND BORDER 
PROTECTION, 

Defendant. 



I. INTRODUCTION 

These are cross-motions for summary judgment in an action challenging the adequacy of the 
response of the U.S. Customs and Border Protection ("CBP") to various Freedom of Information 
Act ("FOIA") and Privacy Act requests made by plaintiff Edward Hasbrouck in 2007 and 2009. 
Hasbrouck requested information about himself contained in various CBP law enforcement 
databases, information about searching for and retrieving data from those databases, and information 
about the processing of one of his Privacy Act requests. CBP released certain documents in their 
entirety, released other documents with redactions, and withheld other documents in their entirety. 
As set out below, the record establishes that while CBP's withholding decisions generally are 
supported by the law and the facts, some issues remain as to the adequacy of its search efforts and 
the completeness of its production. 
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H. BACKGROUND 

Plaintiff Hasbrouck is a self-described professional journalist, author, and blogger. He was 
formerly a travel agent and asserts he is recognized as an expert on numerous travel-related issues. 
Hasbrouck serves as a consultant on travel-related issues to the Identity Project, a non-profit 
organization that provides advice, assistance, publicity, and legal defense to those who believe their 
rights have been infringed, or their legitimate activities curtailed, by demands for identification. 

This action arises from four requests for disclosure of information that Hasbrouck made to 
the CBP. First, Hasbrouck made a Privacy Act request to the CBP Office of Field Operations in 
2007 for copies of all information relating to himself "contained in the system of records established 
for the Automated Targeting System ("ATS")," as described in the System of Records Notice 
("SORN"). He also filed an administrative appeal related to this request. 

In October of 2009, Hasbrouck submitted a second Privacy Act request to CBP in which he 
both renewed his earlier request for ATS records, and additionally sought copies of all information 
about himself from these additional systems of records: Advance Passenger Information System 
(APIS); Border Crossing Information System (BCIS); and U.S. Customs and Border Protection 
TECS. He included a request for all Passenger Name Record (PNR) and Interagency Border 
Inspection System (IBIS) data, regardless of where it was located, as well as all information about 
him referenced in the "Categories of Records in the System" section of the SORN, and an 
accounting of all disclosures of any of these records. He filed an appeal when he received no 
response. 

On the same date in October of 2009 , Hasbrouck made a separate request under FOIA and 
the Privacy Act seeking copies of any and all documents and records created by CBP or other 
agencies in the course of processing of his 2007 Privacy Act request and appeal. An appeal again 
followed when he received no response. 

Finally, on the same date, Hasbrouck made another separate request under FOIA for copies 
of any and all documents and records describing the search systems and methods, indexing, query 
formats and options, data fields and formatting, and the numbers or other identifying particulars by 
which PNR or other data can be retrieved from ATS, APIS, BCIS, ADIS, and TECS. Specifically, 
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he asked for "[A]ny user manuals, training manuals or materials, reference manuals, query format 
guides, search protocols or instructions, interpretation guides, standard operating procedures, 
contract specifications, software use cases or other functional or technical specifications, 
Application Programming Interface (API) specifications and formats for any software or systems 
which contain, process, or interact with these records, and the contents of any online or electronic 
help or reference system for any of these systems." Once again, an administrative appeal resulted 
when he received no response. 

After this action was filed, the parties engaged in meet and confer negotiations, which they 
report were successful in narrowing the scope of their disputes to some degree. They brought these 
cross-motions seeking resolution of the remaining issues. As reflected by the briefing, however, 
some of the disputes continued to evolve, and at the hearing the parties acknowledged that further 
meet and confer may be appropriate in some instances. This order, therefore will provide resolution 
as to those issues on which the parties have clearly reached impasse, but will direct them to engage 
in further discussions to resolve any disputes that may not be fully disposed of herein. 

III. DISCUSSION 

A. Privacy Act exemptions 

Hasbrouck contends that CBP is improperly relying on regulatory exemptions adopted in 
2010 to withhold materials that would otherwise be responsive to his Privacy Act requests made in 
2007 and 2009. In the context of exemptions to disclosure under FOIA, the rule is clear that 
exemptions in effect by the time of any lawsuit are a sufficient basis to preclude disclosure, even if 
enacted after the request in dispute was made. See Southwest Center, for Biological Diversity v. 
Dep't of Agriculture, 314F.3d 1060, 1061 (9th Cir. 2002). 

As explained in Southwest Center, "[t]here are many situations in which 'a court should 
apply the law in effect at the time it renders its decision.'" Id. (quoting Landgrafv. USI Film 
Products, 511 U.S. 244, 273 (1994)). Applying present law will only be characterized as having 
"retroactive" effect where doing so "would impair rights a party possessed when he acted, increase a 
party's liability for past conduct, or impose new duties with respect to transactions already 
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completed." Landgraf 511 U.S. at 280. Although a party requesting information under FOIA prior 
to the enactment of an applicable exemption arguably has a "right" to that information that is 
"impaired" by the subsequent adoption of the exemption, Southwest Center makes clear there is no 
objectionable "retroactive effect," because the party cannot show prejudicial reliance on the prior 
state of the law. See Southwest Center, 314 F.3d at 1062 ("the 'action' of the Center was merely to 
request or sue for information; it was not to take a position in reliance upon existing law that would 
prejudice the Center when that law was changed."); see also Center for Biological Diversity v. U.S. 
Dept. of Agriculture, 626 F.3d 1113, 11 17-18 (9th Cir. 2010) (following Southwest Center and 
further explaining that there is no retroactive effect where plaintiff is seeking the prospective relief 
of an order compelling disclosure of information). 

Hasbrouck argues that Southwest Center is not controlling here because the Privacy Act 
serves different purposes than FOIA. See Flowers v. Exec. Office of the President, 142 F. Supp. 2d 
38, 42 (D.D.C. 2001) ("the purposes of the Privacy Act and the FOIA are quite different: the FOIA 
was enacted to provide citizens with better access to government records, while the Privacy Act was 
adopted to safeguard individuals against invasions of their privacy."). As a result, Hasbrouck 
contends, he had a "vested" and private interest in reviewing information about himself maintained 
by the CBP that is materially different than the public interest rights asserted by the plaintiff in 
Southwest Center. In a similar vein, Hasbrouck insists that, unlike the Southwest Center plaintiff, he 
can show he prejudicially relied on the former state of the law, in that he would have avoided 
disclosing information that might end up in the possession of the CBP had he known that he would 
subsequently be precluded from reviewing CBP records to safeguard his privacy rights. 

Both these arguments, however, prove too much. Hasbrouck has not argued, and could not 
reasonably do so, that exemptions promulgated in 2010 would not apply to any request he might 
make today. Yet the same previously-collected information would fall within the scope of the 
exemptions and could properly be withheld from any materials produced in response to a new 
request. This highlights the observation in Biological Diversity that "retroactivity" simply is not 
implicated, because plaintiff's claim in essence seeks prospective injunctive relief — an order 
requiring CBP to turn over information now. As such, this is one of the many circumstances in 
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which "a court should apply the law in effect at the time it renders its decision," notwithstanding the 
happenstance that Hasbrouck made his Privacy Act requests before the current exemptions were 
promulgated. 

Finally, Hasbrouck also argues that analysis under Landgraf is inappropriate here without 
first addressing the "threshold question" of whether the CBP has statutory authority to engage in 
"retroactive rulemaking" in the first instance. See Bowen v. Georgetown Univ. Hosp., 488 U.S. 204, 
208 (1988) ("In determining the validity of the Secretary's retroactive cost-limit rule, the threshold 
question is whether the Medicare Act authorizes retroactive rulemaking."). Hasbrouck' s reliance on 
Bowen is misplaced. In that case, there was no dispute that the regulation at issue, as applied by the 
agency, had a retroactive effect. See 488 U.S. at 207 ("In effect, the Secretary had promulgated a 
rule retroactively, and the net result was as if the original rule had never been set aside.") The only 
question was whether the agency had the power to adopt a retroactive rule. See id. at 209 ("The 
Secretary contends that the Medicare Act provides the necessary authority to promulgate retroactive 
cost-limit rules . . . .") 

Here, in contrast, the question is not whether CBP might have the authority to adopt a 
retroactive regulation, but whether applying the exemptions promulgated in 2010 to this case can be 
characterized under Landgraf as a "retroactive" application of the regulations. For the reasons 
explained above, it cannot. Accordingly, CBP's potential statutory authority to adopt truly 
retroactive regulations — or its lack thereof — is simply irrelevant to the analysis. 1 CBP therefore is 
entitled to rely on exemptions promulgated after the dates on which Hasbrouck made his Privacy 
Act requests. 



1 Southwest Center introduces the term "impermissible retroactive effect," which arguably implies 
that the FOIA exemption it was considering was "retroactive," just not impermissibly so. In 
context, however, it is clear that Southwest Center found it permissible to apply the recently-enacted 
FOIA exemption to the case before it because doing so could not be characterized as "retroactive" 
under Landgraf. See Landgraf, at 51 1 U.S. at 269 ("A statute does not operate 'retrospectively' 
merely because it is applied in a case arising from conduct antedating the statute's enactment.") 
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B. " Personal identifiers " 

Hasbrouck contends that he has a right both under the Privacy Act and FOIA to disclosure of 
the list of "personal" or "unique" identifiers by which data can be retrieved from an individual's 
ATS, APIS, BCIS, AD IS, and TECS records. CBP publicly discloses that records can be searched 
by an individual's name and address, but does not list what other "personal" or "unique" identifiers 
it maintains. Hasbrouck speculates that the list likely includes such identifiers as birthdates, 
passport numbers, credit card numbers, telephone numbers, and the like. 

As seemingly innocuous as such a list might appear to be at first blush, CBP asserts that it is 
entitled to withhold such information pursuant to FOIA Exemption 7(E), 5 U.S.C.§ 552(b)(7)(E). 
That exemption permits withholding of records or information compiled for law enforcement 
purposes that would "disclose techniques and procedures for law enforcement investigations or 
prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if 
such disclosure could reasonably be expected to risk circumvention of the law." Perhaps because 
the scope of the parties' dispute did not crystallize until late in the briefing process, neither side 
provided focused argument on how disclosure of merely the list of personal or unique identifiers 
would or would not impact law enforcement investigations or prosecutions. Nevertheless, CBP's 
showing as to the applicability of Exemption 7(E) to broader aspects of Hasbrouck' s requests is 
sufficient to establish that even the list of identifiers has been properly withheld. 

While it may be of little consequence to law enforcement efforts to disclose that CBP can 
retrieve information based on obvious identifiers such as birthdates, passport numbers, or similar 
data, it manifestly would implicate security concerns to disclose that CBP also tracks one or more 
non-obvious identifier, or for it to admit that it cannot retrieve information except by obvious 
identifiers. Accordingly, CBP need not provide the list of identifiers Hasbrouck is seeking. 
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C. Adequacy of search efforts 

1 . Software specifications 

Hasbrouck asserts that he seeks information regarding the software used with CBP's 
databases so that he can determine what "personal identifiers" may be used to retrieve information. 
In light of the conclusion of the preceding section, CBP need not respond further to this category. 

2. Search parameters 

CBP has not shown why it would be unreasonable, unduly burdensome, or otherwise 
inappropriate to require it to conduct electronic searches for responsive information with variant 
spellings of Hasbrouck' s name, as specified in his requests. While it may be true that Hasbrouck 
would be unlikely to misspell his own name, it is plausible that it would not always be entered into 
data sources correctly. Accordingly, CBP shall run searches using the parameters requested by 
Hasbrouck, and produce any non-cumulative results that are not subject to withholding on some 
other basis. 

3. "Search logs, " " Significant Activity Reports, " correspondence, and other 

materials 

CBP contends that Hasbrouck' s remaining complaints as to the adequacy of its search efforts 
or production relate to materials either that simply do not exist, or as to which Hasbrouck has not 
adequately explained what he is looking for. CBP acknowledges, however, that in at least some 
instances it could provide further information, either in meet and confer negotiations, or by 
declaration that would more fully explain why it believes no further documents need be produced. 
At the hearing, CBP also admitted that it contends certain documents are not only non-responsive to 
the requests, but also exempt from disclosure. To the extent CBP intends to rely on exemptions, 
even in the alternative, it should supplement its Vaughn index. 

The current record does not permit a conclusive determination as to exactly what remains in 
actual dispute. CBP, of course, cannot be compelled to produce materials that do not exist, and at 
some point its declarations so stating must be accepted, even if Hasbrouck believes additional 
materials should exist. Accordingly, the parties are hereby directed to engage in further meet and 
confer discussions to clarify, and potentially resolve, any disputes that may remain between them. 
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IV. CONCLUSION 



CBP's motion is granted to the extent that the rulings set forth above relieve it of producing 
particular further items or categories of information. Conversely, Hasbrouck's motion is granted to 
the extent this order requires CBP to engage in further searches and the production of any resulting 
information. The motions are otherwise denied without prejudice. The parties shall engage in 
further meet and confer discussions to address their remaining disputes. Within 60 days of the date 
of this order the parties shall submit a joint report setting out: 

1 . Any issues that are ripe for further adjudication by the Court as to the respective rights 
and obligations of the parties. 

2. The status of any issues which the parties are continuing to discuss, or which cannot be 
fully resolved pending possible further responses from CBP to Hasbrouck's requests. 

3. The parties' joint or separate proposals for a procedure and schedule for bringing this 
litigation to final resolution, including their views as to whether a judgment will be necessary and 
the form any judgment should take. 



Dated: 1/23/12 



IT IS SO ORDERED. 




RICHARD SEEBORG 

UNITED STATES DISTRICT JUDGE 
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